Critical
CVE-2026-94589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-104898
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Medium
CVE-2026-103365
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Critical
CVE-2026-107645
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
Blocksy Companion allows unauthenticated attackers to gain Dokan vendor privileges and automatic login during registration, even if vendor signup is turned off.
Critical
CVE-2026-104732
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
High
CVE-2026-104797
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
Medium
CVE-2026-96743
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
Medium
CVE-2026-93883
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
Medium
CVE-2026-104915
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Medium
CVE-2026-107419
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
Medium
CVE-2026-62029
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62039
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-104022
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Medium
CVE-2026-62036
All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-62040
Restrict User Access – Ultimate Membership & Content Protection <= 2.8.1 - Missing Authorization
Medium
CVE-2026-62028
Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Missing Authorization
Medium
CVE-2026-62041
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
Medium
CVE-2026-62026
Dashboard Notes <= 1.0.3 - Cross-Site Request Forgery
Medium
CVE-2026-39779
Asgaros Forum <= 3.4.0 - Missing Authorization
Medium
CVE-2026-62049
JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62042
Scripts n Styles <= 3.5.8 - Missing Authorization
Medium
CVE-2025-14123
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
High
CVE-2026-81929
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
Low
CVE-2026-94258
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.